Privacy Policy

The Bravi Ragazzi website is operated by Functional Time, Lda., Portuguese company/tax number 517298465, registered office at Rua Sá de Miranda, 82-A, 2855-482 Corroios, Portugal. The restaurant is located at Rua Armando Guerreiro, 22-A, 2855-593 Corroios, Portugal.

For privacy-related requests, contact pizzerialopes@gmail.com.

Depending on how you use the website, we may process:

• Reservations: name, telephone number, email address if provided, date, time, party size, language, source, booking reference and status.
• Take-away orders: name, contact details, products, customisations, prices, collection date/time, order references and operational history.
• Invoicing: optional Portuguese tax number (NIF) when requested and information required for the restaurant's invoicing system.
• Payments: amount, method, payment status, transaction identifiers, attempts and refunds. We do not store complete payment-card numbers or card security codes on our website.
• Marketing: email, preferences, consent record, wording version, subscription source/date, withdrawal and objections.
• Communications and privacy requests: information needed to respond to your enquiry or rights request.
• Website operation and security: cookies, technical identifiers, access and security records, and information needed to prevent abuse.
• Internal administration: authorised staff accounts, roles, authentication and audit records.

Our standard booking and order forms are not designed to collect health data. If such information is incidentally provided, its use will be restricted to what is necessary and subject to the additional safeguards and lawful conditions that apply.

We use personal information to:

• Manage reservations, orders and operational notifications, under contractual or pre-contractual necessity (Article 6(1)(b) GDPR).
• Process and reconcile payments, refunds and complaints, under contractual necessity and, where applicable, legal obligations or legitimate interests in security and legal claims (Article 6(1)(b), (c) and (f)).
• Comply with tax and accounting rules, under legal obligation (Article 6(1)(c)).
• Protect our services from fraud, misuse and unauthorised access, under appropriately balanced legitimate interests or applicable legal obligations (Article 6(1)(f) and (c)).
• Send promotional emails, only with specific, voluntary and demonstrable consent (Article 6(1)(a) and Portuguese electronic communications rules).
• Use non-essential analytics technologies, only after obtaining the consent required by law.
• Respond to GDPR rights requests, under legal obligation (Article 6(1)(c)).

Marketing and analytics consent are not required to make a reservation or place an order.

Online payments by card or MB WAY, where available, are processed through Stripe under the applicable contracted arrangements. Invoices are issued through the restaurant's separate POS/invoicing system. A tax number is requested only when you choose to provide one for invoicing purposes.

We retain personal information only while necessary for its purpose, subject to legal duties and justified exceptions. Our operational retention criteria are:

These periods must be implemented and subject to a lawful basis for each purpose. They do not require deletion where an active matter, tax obligation, dispute or unsettled refund justifies limited retention. Once no lawful reason remains, information is deleted or appropriately anonymised.

Minimum evidence of marketing consent and suppression records may be retained as reasonably necessary to demonstrate compliance and honour objections. Opening an email or placing a new order does not automatically renew consent. Backups follow their own limited retention and post-restore reconciliation procedures.

Authorised staff and, when actually used, service providers may process information as necessary, including Supabase (database, authentication and files), Cloudflare (hosting and security), Stripe (payments), Resend (emails), Google (email and, with consent, analytics), and invoicing or accounting service providers.

We do not sell customer lists to advertisers. Disclosures to authorities may occur where required by law.

Some providers may involve data access or processing outside the European Economic Area. Where applicable, international transfers will be subject to the safeguards required by the GDPR, such as adequacy decisions or appropriate contractual measures. You may request information about transfers and safeguards via our privacy contact.

Promotional email subscription is optional and unticked by default. You can withdraw it using the unsubscribe link or by contacting us. Essential booking/order notices are separate from marketing.

Non-essential analytics technologies are enabled only after the required consent. You can refuse or change your choice through Privacy Preferences on the website. See the Cookie Policy for details. Imported contacts are not automatically treated as marketing subscribers merely because an older platform labelled them as such.

We apply proportionate access controls, authentication, communications security, logging, data minimisation and related safeguards.

Subject to the conditions in the GDPR, you may request access, correction, erasure, restriction, portability or objection, and withdraw consent where applicable. Email pizzerialopes@gmail.com. Where there are reasonable doubts about identity, we may request proportionate additional information; we do not routinely require copies of identity documents.

We normally respond within one month; extensions are possible where legally justified and communicated within the initial period. Erasure rights are not absolute, for example where retention is required by law or needed for legal claims.

You may contact us regarding any privacy issue and complain to the Portuguese supervisory authority, CNPD, at www.cnpd.pt.

External websites and delivery platforms are subject to their own privacy policies. We may update this policy and will display the effective version/date on our website.